CVE-2009-0677

avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the pregreplace function with the eval switch, ...

CVE-2009-0672

SQL injection vulnerability in the ResendEmail module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the userprefix parameter to modules.php...

CVE-2009-0678

CVE-2009-0678 affects RavenNuke 2.30. The vulnerability in images/captcha.php arises from an aFonts array parameter value that does not map to a valid font file, causing an error message that reveals the installation path. The NVD entry lists a base CVSSv2 score of 5.0 (Medium) with network attac...

CVE-2009-0674

images/captcha.php in Raven Web Services RavenNuke 2.30, when registerglobals and displayerrors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ...

CVE-2009-0672

The CVE shows a SQL injection in the RavenNuke 2.30 Resend_Email module, exploitable via the user_prefix parameter to modules.php. Affected component: Raven Web Services (Resend_Email). Root cause: improper handling of user_prefix leads to arbitrary SQL commands when accessed by remote authentica...

Debian: Security Advisory (DSA-624-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2006-7055

CVE-2006-7055 describes a PHP remote file inclusion in TotalCalendar 2.30 and earlier. The vulnerability is triggered via the inc_dir parameter in index.php, allowing a remote attacker to cause arbitrary PHP code execution by supplying a URL. This is a separate vector from CVE-2006-1922 and CVE-2...

CVE-2006-4830

CVE-2006-4830 affects Blojsom 2.30, via EditBlogTemplatesPlugin.java. A directory traversal vulnerability is triggered by an HTTP request containing a crafted blogTemplate value, with impact described as unknown in the entry. No exploitation details or patch information are provided in the connec...

CVE-2006-2281

X-Scripts X-Poll (xpoll) 2.30 is affected by an RCE via admin/images/add.php: an attacker can upload a PHP file and access it remotely. The underlying issue is improper file upload handling that allows execution of arbitrary PHP code. This affects the product as described in CVE-2006-2281 and is ...

[SA19760] Dnsmasq DHCP Broadcast Reply Denial of Service

TITLE: Dnsmasq DHCP Broadcast Reply Denial of Service SECUNIA ADVISORY ID: SA19760 VERIFY ADVISORY: http://secunia.com/advisories/19760/ CRITICAL: Less critical IMPACT: DoS WHERE: From local network SOFTWARE: Dnsmasq 2.x http://secunia.com/product/4837/ DESCRIPTION: A vulnerability has been...

CVE-2004-1218

CVE-2004-1218 relates to the Remote Execute 2.30 product, where remote attackers can cause an application crash (DoS) by establishing 7 simultaneous connections. The provided documents do not specify affected platforms, software versions beyond 2.30, root cause details, concrete exploit steps, or...

[slackware-security] gaim updated again

A couple of bugs were found in the gaim 0.82 release, and gaim-0.82.1 was released to fix them. In addition, gaim-encryption-2.29 did not work with gaim-0.82 due to changes in the header files, so the gaim-encryption plugin has also been updated to gaim-encryption-2.30. Here are the details from...

CVE-2004-0661

Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers to cause a denial of service IP lease depletion via a DHCP request with the LEASETIME option set to -1, which makes the DHCP lease valid for thirteen or more years...

DLINK 614+, script injection vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: Security flaw in DLINK 614+ - SOHO routers http://www.dlink.com TYPE: Script injection over DHCP QUOTE from DLINK: The AirPlus DI-614+ combines the latest advancements in 802.11b silicon chip design from Texas Instruments, utilizing their...